Sailpoint Identity Security Cloud
Version 2.0.0 (View all)
Managed integration release status GA
Subscription level
What's this?		 Basic
Developed by
What's this?		 Elastic
Ingestion method(s) API
Minimum Kibana version(s) 9.0.5
8.19.2
Important - Managed integrations on Elastic Cloud Hosted

You can use this integration as an Elastic Managed integration on Elastic Cloud Hosted deployments running this version or later.

The Elastic integration for Sailpoint Identity Security Cloud enables real-time monitoring and analysis of identity security events within the SailPoint platform. This integration collects, processes, and visualizes audit logs, access activities, and identity lifecycle events to enhance security posture, compliance, and operational efficiency.

Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to Agentless integrations and the Agentless integrations FAQ. Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

  • events: Provides audit data that includes actions such as USER_MANAGEMENT, PASSWORD_ACTIVITY, PROVISIONING, ACCESS_ITEM, SOURCE_MANAGEMENT, CERTIFICATION, AUTH, SYSTEM_CONFIG, ACCESS_REQUEST, SSO, WORKFLOW, SEGMENT and more. Audit Events are records that a user took action in an IdentityNow tenant, or other service like IdentityAI. This data stream leverages the /v2026/search endpoint.

  • identities: Collects human identity records (employees, contractors, and external users) governed by SailPoint ISC. Each document represents the current governance state of an identity including their access entitlements, owned governance objects, manager relationships, and segment memberships. Designed for entity analytics, user risk scoring, and identity-correlated security detections. Uses incremental collection via the Search API with a searchAfter cursor so only identities modified since the last run are fetched.

  • machine_identities: Collects machine/non-human identity records (service accounts, application accounts, bots, and AI agents) governed by SailPoint ISC. Each document represents a machine identity with its owner relationships and held entitlements. Uses the experimental Machine Identities API with a full offset-based scan each collection cycle. Note: This data stream depends on an experimental SailPoint API (X-SailPoint-Experimental: true). The API may change without notice in future SailPoint releases. HTTP 404 and 501 responses are treated as "feature not enabled" rather than errors.

This integration uses OAuth2 client_credentials to authenticate against the SailPoint ISC API.

  1. Log in to the SailPoint ISC admin console.
  2. Navigate to Admin → Security Settings → API Management.
  3. Click Create API Client, select Client Credentials as grant type, and grant the following scopes:
    • sp:search:read — required for the events and identities data streams
    • idn:mis-identity:read and idn:mis-identity:manage — required for the machine_identities data stream (experimental API)
  4. Note the generated Client ID and Client Secret for use in the integration configuration.

For further details see the official Authentication documentation.

Event documents can be found by setting the following filter: event.dataset : "sailpoint_identity_sc.events"

Example 
{
    "@timestamp": "2024-12-12T10:58:27.962Z",
    "agent": {
        "ephemeral_id": "f7c9ed4a-2f7e-44b0-8b64-a860ca47b6de",
        "id": "b1537110-453a-4e7a-9523-15d60cb34be2",
        "name": "elastic-agent-35846",
        "type": "filebeat",
        "version": "9.4.4"
    },
    "data_stream": {
        "dataset": "sailpoint_identity_sc.events",
        "namespace": "19971",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "b1537110-453a-4e7a-9523-15d60cb34be2",
        "snapshot": false,
        "version": "9.4.4"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "dataset": "sailpoint_identity_sc.events",
        "ingested": "2026-08-27T07:08:39Z",
        "kind": "event",
        "module": "sailpoint_identity_sc",
        "type": [
            "info"
        ]
    },
    "host": {
        "geo": {
            "city_name": "Milton",
            "continent_name": "North America",
            "country_iso_code": "US",
            "country_name": "United States",
            "location": {
                "coordinates": [
                    -122.31490007601678,
                    47.25129998289049
                ],
                "type": "Point"
            },
            "region_iso_code": "US-WA",
            "region_name": "Washington"
        },
        "ip": [
            "216.160.83.56"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "hosts": [
            "216.160.83.56"
        ],
        "user": [
            "test.user"
        ]
    },
    "sailpoint_identity_sc": {
        "events": {
            "_type": "event",
            "_version": "v2",
            "action": "USER_PASSWORD_UPDATE_PASSED",
            "actor": {
                "name": "test.user"
            },
            "attributes": {
                "account_id": "test.user",
                "host_name": "216.160.83.56",
                "info": "Password workflow invoked successfully. Request Id :923169315cab448cac82091dc4827f38",
                "org": "ta-partner14055",
                "pod": "se01-useast1",
                "scope": "sp:scopes:all",
                "source_name": "IdentityNow"
            },
            "created": "2024-12-12T10:58:27.962Z",
            "details": "38eef046d4594d7e9186cee997232f3d",
            "id": "f514ad697321c49b61b65ec9b5099a192eb598d2c520d4e09f958f7abdfc16dd",
            "ip_address": "216.160.83.56",
            "name": "Update User Password Passed",
            "objects": [
                "USER",
                "PASSWORD"
            ],
            "operation": "UPDATE",
            "org": "ta-partner14055",
            "pod": "se01-useast1",
            "stack": "pigs",
            "status": "PASSED",
            "synced": "2024-12-23T10:58:32.977Z",
            "target": {
                "name": "test.user"
            },
            "technical_name": "USER_PASSWORD_UPDATE_PASSED",
            "tracking_number": "fb38cc3fb990451dab51133aed21268a",
            "type": "PASSWORD_ACTIVITY"
        }
    },
    "tags": [
        "forwarded",
        "sailpoint_identity_sc.events"
    ],
    "user": {
        "entity": {
            "lifecycle": {
                "last_activity": "2024-12-12T10:58:27.962Z"
            },
            "name": "test.user",
            "type": [
                "user"
            ]
        }
    }
}

ECS Field Reference

Refer to the following document for detailed information on ECS fields.

The following non-ECS fields are used in events documents:

Exported fields
Field Description Type
@timestamp Event timestamp. date
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
ecs.version ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. keyword
event.category This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. event.category represents the "big buckets" of ECS categories. For example, filtering on event.category:process yields all events relating to process activity. This field is closely related to event.type, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. keyword
event.dataset Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. keyword
event.id Unique ID to describe the event. keyword
event.kind This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. event.kind gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. keyword
event.module Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), event.module should contain the name of this module. keyword
event.original Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from _source. If users wish to override this and index this field, please see Field data types in the Elasticsearch Reference. keyword
event.type This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. event.type represents a categorization "sub-bucket" that, when used along with the event.category field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. keyword
host.geo.city_name City name. keyword
host.geo.continent_name Name of the continent. keyword
host.geo.country_iso_code Country ISO code. keyword
host.geo.country_name Country name. keyword
host.geo.location Longitude and latitude. geo_point
host.geo.region_iso_code Region ISO code. keyword
host.geo.region_name Region name. keyword
host.ip Host ip addresses. ip
input.type Input type. keyword
related.hosts All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. keyword
related.user All the user names or other user identifiers seen on the event. keyword
sailpoint_identity_sc.events._type Document type of the access profile. This enum represents currently supported document types. Additional values may be introduced in the future without prior notice. keyword
sailpoint_identity_sc.events._version Version of the SailPoint events. Example: V2. keyword
sailpoint_identity_sc.events.action Event name as displayed in audit reports. keyword
sailpoint_identity_sc.events.actor.display_name Display name of the actor responsible for generating the event. keyword
sailpoint_identity_sc.events.actor.id Unique identifier of the actor responsible for generating the event. keyword
sailpoint_identity_sc.events.actor.name Name of the actor responsible for generating the event. Example: System. keyword
sailpoint_identity_sc.events.attributes.access_profiles_after Access profiles assigned after the event. keyword
sailpoint_identity_sc.events.attributes.access_profiles_before Access profiles assigned before the event. keyword
sailpoint_identity_sc.events.attributes.account_id Account identifier. keyword
sailpoint_identity_sc.events.attributes.account_name Name of the account. keyword
sailpoint_identity_sc.events.attributes.account_source Source of the account. keyword
sailpoint_identity_sc.events.attributes.account_uuid Unique identifier for the account. keyword
sailpoint_identity_sc.events.attributes.app_id Application identifier. keyword
sailpoint_identity_sc.events.attributes.attribute_name Name of the attribute. keyword
sailpoint_identity_sc.events.attributes.attribute_value Value of the attribute. keyword
sailpoint_identity_sc.events.attributes.business_application Name of the business application associated with the event. keyword
sailpoint_identity_sc.events.attributes.cloud_app_name Name of the cloud application. keyword
sailpoint_identity_sc.events.attributes.description Description of the entity. keyword
sailpoint_identity_sc.events.attributes.duration Duration of the process. keyword
sailpoint_identity_sc.events.attributes.errors Errors related to the event. keyword
sailpoint_identity_sc.events.attributes.host_name Hostname involved in the event. ip
sailpoint_identity_sc.events.attributes.id Unique identifier. keyword
sailpoint_identity_sc.events.attributes.identities_processed Identifier for processed identities. keyword
sailpoint_identity_sc.events.attributes.identities_selected Number of selected identities. keyword
sailpoint_identity_sc.events.attributes.identities_total Total number of identities involved. keyword
sailpoint_identity_sc.events.attributes.identity_id Identifier of the identity associated with the event. keyword
sailpoint_identity_sc.events.attributes.identity_name Name of the identity associated with the event. keyword
sailpoint_identity_sc.events.attributes.info Information related to the attribute in the event. Example: SailPoint. keyword
sailpoint_identity_sc.events.attributes.interface Interface associated with the event. keyword
sailpoint_identity_sc.events.attributes.manually_created Indicates whether the entity was created manually. keyword
sailpoint_identity_sc.events.attributes.manually_edited Indicates whether the entity was edited manually. keyword
sailpoint_identity_sc.events.attributes.match_all_account Criteria for matching all accounts. keyword
sailpoint_identity_sc.events.attributes.match_all_accounts_after Matching criteria for accounts after the event. keyword
sailpoint_identity_sc.events.attributes.match_all_accounts_before Matching criteria for accounts before the event. keyword
sailpoint_identity_sc.events.attributes.modified_after Last modification timestamp after the event. keyword
sailpoint_identity_sc.events.attributes.modified_before Last modification timestamp before the event. keyword
sailpoint_identity_sc.events.attributes.name Name of the entity. keyword
sailpoint_identity_sc.events.attributes.operation Type of operation. keyword
sailpoint_identity_sc.events.attributes.org Organization involved in the event. Example: acme. keyword
sailpoint_identity_sc.events.attributes.owners JSON-encoded array of owner references for the entity. keyword
sailpoint_identity_sc.events.attributes.pod Pod name involved in the event. Example: stg03-useast1. keyword
sailpoint_identity_sc.events.attributes.process_id Process identifier. keyword
sailpoint_identity_sc.events.attributes.scope Scope of the event. keyword
sailpoint_identity_sc.events.attributes.segment Segment associated with the event. keyword
sailpoint_identity_sc.events.attributes.source_name Name of the source involved in the event. keyword
sailpoint_identity_sc.events.attributes.subtype Subtype of the entity involved in the event. keyword
sailpoint_identity_sc.events.attributes.user_entitlements JSON-encoded array of entitlement identifiers granted to the identity. keyword
sailpoint_identity_sc.events.attributes.user_id User identifier. keyword
sailpoint_identity_sc.events.attributes.users_added Users added during the event. keyword
sailpoint_identity_sc.events.created ISO-8601 date-time indicating when the object was created. date
sailpoint_identity_sc.events.details Identifier for event details. keyword
sailpoint_identity_sc.events.id Unique identifier for the access profile. keyword
sailpoint_identity_sc.events.ip_address IP address of the target system. ip
sailpoint_identity_sc.events.name Name of the access profile. keyword
sailpoint_identity_sc.events.objects Objects affected by the event. keyword
sailpoint_identity_sc.events.operation Operation or action performed during the event. keyword
sailpoint_identity_sc.events.org Organization associated with the event. Example: acme. keyword
sailpoint_identity_sc.events.pod Name of the pod involved in the event. Example: stg03-useast1. keyword
sailpoint_identity_sc.events.stack The event stack. Example: Type. keyword
sailpoint_identity_sc.events.status Status of the event. keyword
sailpoint_identity_sc.events.synced ISO-8601 date-time indicating when the object was queued for synchronization into the search database for API use. date
sailpoint_identity_sc.events.target.name Name of the target or recipient of the event. keyword
sailpoint_identity_sc.events.technical_name Normalized event name following the pattern 'objects_operation_status'. keyword
sailpoint_identity_sc.events.tracking_number Identifier for the group of events. keyword
sailpoint_identity_sc.events.type Type of event. Refer to the Event Types list for more details. Example: "IDENTITY_PROCESSING". keyword
tags List of keywords used to tag each event. keyword
user.entity.id A unique identifier for the entity. When multiple identifiers exist, this should be the most stable and commonly used identifier that: 1) persists across the entity's lifecycle, 2) ensures uniqueness within its scope, 3) is commonly used for queries and correlation, and 4) is readily available in most observations (logs/events). For entities with dedicated field sets (for example, host, user), this value should match the corresponding *.id field. Alternative identifiers (for example, ARNs values in AWS, URLs) can be preserved in the raw field. keyword
user.entity.lifecycle.last_activity Timestamp of the most recent action performed by or attributed to this entity (active use). Distinct from entity.last_seen_timestamp, which records when the entity was last observed in data; last_activity implies the entity was active, not only seen. Typically applicable to User, Host, and Service entities. date
user.entity.name The name of the entity. The keyword field enables exact matches for filtering and aggregations, while the text field enables full-text search. For entities with dedicated field sets (for example, host), this field should mirrors the corresponding *.name value. keyword
user.entity.name.text Multi-field of user.entity.name. match_only_text
user.entity.type A standardized high-level classification of the entity. This provides a normalized way to group similar entities across different providers or systems. Example values: bucket, database, container, function, queue, host, user, application, session, cloud, orchestrator, etc. If an entity is nested under a top-level namespace like host or cloud, or similar, its type array should include the matching value — for example, host or cloud. keyword

Identity documents can be found by setting the following filter: event.dataset : "sailpoint_identity_sc.identities"

Identity documents carry ECS entity fields (user.entity.*) that enable Entity Analytics, user risk scoring, and identity-correlated detections.

Example 
{
    "@timestamp": "2025-01-10T00:00:00.000Z",
    "agent": {
        "ephemeral_id": "d7ae794a-742b-42e3-8a14-f50bd1f875bc",
        "id": "0d470254-5a34-419d-8c18-4b77c9f41faa",
        "name": "elastic-agent-69149",
        "type": "filebeat",
        "version": "9.5.3"
    },
    "data_stream": {
        "dataset": "sailpoint_identity_sc.identities",
        "namespace": "70818",
        "type": "logs"
    },
    "ecs": {
        "version": "9.4.0"
    },
    "elastic_agent": {
        "id": "0d470254-5a34-419d-8c18-4b77c9f41faa",
        "snapshot": false,
        "version": "9.5.3"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "dataset": "sailpoint_identity_sc.identities",
        "ingested": "2026-09-14T10:59:26Z",
        "kind": "asset",
        "module": "sailpoint_identity_sc",
        "original": "{\"_type\":\"identity\",\"created\":\"2024-04-04T21:36:00.000Z\",\"disabled\":false,\"displayName\":\"Alice Johnson\",\"email\":\"alice.johnson@example.com\",\"firstName\":\"Alice\",\"id\":\"identity-id-001\",\"inactive\":false,\"isManager\":true,\"lastName\":\"Johnson\",\"locked\":false,\"modified\":\"2025-01-10T00:00:00.000Z\",\"name\":\"alice.johnson\",\"protected\":false,\"status\":\"ACTIVE\",\"synced\":\"2025-01-10T01:00:00.000Z\",\"type\":\"identity\"}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "user": [
            "alice.johnson",
            "Alice Johnson"
        ]
    },
    "sailpoint_identity_sc": {
        "identity": {
            "created": "2024-04-04T21:36:00.000Z",
            "disabled": false,
            "inactive": false,
            "is_manager": true,
            "locked": false,
            "protected": false,
            "status": "ACTIVE"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "sailpoint_identity_sc.identities"
    ],
    "user": {
        "domain": "example.com",
        "email": "alice.johnson@example.com",
        "entity": {
            "id": "identity-id-001",
            "name": "Alice Johnson",
            "type": [
                "user"
            ]
        },
        "full_name": "Alice Johnson",
        "id": "identity-id-001",
        "name": "alice.johnson"
    }
}

ECS Field Reference

Refer to the following document for detailed information on ECS fields.

The following non-ECS fields are used in identities documents:

Exported fields
Field Description Type
@timestamp Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. date
data_stream.dataset The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters constant_keyword
data_stream.namespace A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters constant_keyword
data_stream.type An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. constant_keyword
ecs.version ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. keyword
error.message Error message. match_only_text
event.category This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. event.category represents the "big buckets" of ECS categories. For example, filtering on event.category:process yields all events relating to process activity. This field is closely related to event.type, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. keyword
event.dataset Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. constant_keyword
event.kind This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. event.kind gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. keyword
event.module Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), event.module should contain the name of this module. constant_keyword
event.original Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from _source. If users wish to override this and index this field, please see Field data types in the Elasticsearch Reference. keyword
event.type This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. event.type represents a categorization "sub-bucket" that, when used along with the event.category field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. keyword
input.type Input type. keyword
related.user All the user names or other user identifiers seen on the event. keyword
sailpoint_identity_sc.identity.access.attribute Attribute name for entitlement-type access items. keyword
sailpoint_identity_sc.identity.access.cloud_eligible Indicates whether the access item is cloud-eligible. boolean
sailpoint_identity_sc.identity.access.cloud_governed Indicates whether the access item is cloud-governed. boolean
sailpoint_identity_sc.identity.access.description Description of the access item. keyword
sailpoint_identity_sc.identity.access.disabled Indicates whether the access item is disabled. boolean
sailpoint_identity_sc.identity.access.display_name Display name of the access item. keyword
sailpoint_identity_sc.identity.access.enabled Indicates whether the access item is enabled. boolean
sailpoint_identity_sc.identity.access.id Access item ID. keyword
sailpoint_identity_sc.identity.access.name Access item name. keyword
sailpoint_identity_sc.identity.access.owner.display_name Display name of the owner of this access item. keyword
sailpoint_identity_sc.identity.access.owner.id ID of the owner of this access item. keyword
sailpoint_identity_sc.identity.access.owner.name Username of the owner of this access item. keyword
sailpoint_identity_sc.identity.access.privileged Indicates whether the access item grants privileged access. boolean
sailpoint_identity_sc.identity.access.request_comments_required Indicates whether comments are required when requesting this access item. boolean
sailpoint_identity_sc.identity.access.requestable Indicates whether the access item can be requested. boolean
sailpoint_identity_sc.identity.access.revocable Indicates whether the access item can be revoked. boolean
sailpoint_identity_sc.identity.access.schema Schema name for entitlement-type access items. keyword
sailpoint_identity_sc.identity.access.source.id ID of the source system for this access item. keyword
sailpoint_identity_sc.identity.access.source.name Name of the source system for this access item. keyword
sailpoint_identity_sc.identity.access.standalone Indicates whether the access item is standalone. boolean
sailpoint_identity_sc.identity.access.type Type of access item (ENTITLEMENT, ROLE, ACCESS_PROFILE). keyword
sailpoint_identity_sc.identity.access.value Attribute value for entitlement-type access items. keyword
sailpoint_identity_sc.identity.access_count Number of access items assigned to this identity. long
sailpoint_identity_sc.identity.access_profile_count Number of access profiles assigned to this identity. long
sailpoint_identity_sc.identity.account_count Number of accounts associated with this identity. long
sailpoint_identity_sc.identity.accounts.account_id Account identifier on the source system. keyword
sailpoint_identity_sc.identity.accounts.created When the account was created. date
sailpoint_identity_sc.identity.accounts.disabled Indicates whether the account is disabled. boolean
sailpoint_identity_sc.identity.accounts.entitlement_attributes Entitlement attributes on the account (for example, memberOf groups). flattened
sailpoint_identity_sc.identity.accounts.id Account ID. keyword
sailpoint_identity_sc.identity.accounts.locked Indicates whether the account is locked. boolean
sailpoint_identity_sc.identity.accounts.manually_correlated Indicates whether the account was manually correlated to this identity. boolean
sailpoint_identity_sc.identity.accounts.name Account display name. keyword
sailpoint_identity_sc.identity.accounts.password_last_set When the account password was last set. date
sailpoint_identity_sc.identity.accounts.privileged Indicates whether the account has privileged access. boolean
sailpoint_identity_sc.identity.accounts.source.id ID of the source system for this account. keyword
sailpoint_identity_sc.identity.accounts.source.name Name of the source system for this account. keyword
sailpoint_identity_sc.identity.accounts.source.type Type of the source system for this account. keyword
sailpoint_identity_sc.identity.accounts.supports_password_change Indicates whether the account supports password changes. boolean
sailpoint_identity_sc.identity.apps.account.account_id Account identifier on the source system for this application. keyword
sailpoint_identity_sc.identity.apps.account.id ID of the account linked to this application. keyword
sailpoint_identity_sc.identity.apps.id Application ID. keyword
sailpoint_identity_sc.identity.apps.name Application name. keyword
sailpoint_identity_sc.identity.apps.source.id ID of the source associated with this application. keyword
sailpoint_identity_sc.identity.apps.source.name Name of the source associated with this application. keyword
sailpoint_identity_sc.identity.attributes Free-form identity attributes from the authoritative source (tenant-specific keys). flattened
sailpoint_identity_sc.identity.created When the identity was created in SailPoint Identity Security Cloud. date
sailpoint_identity_sc.identity.disabled Indicates whether this identity is disabled. boolean
sailpoint_identity_sc.identity.employee_number Employee number assigned to the identity. keyword
sailpoint_identity_sc.identity.entitlement_count Number of entitlements assigned to this identity. long
sailpoint_identity_sc.identity.identity_profile.id ID of the identity profile this identity belongs to. keyword
sailpoint_identity_sc.identity.identity_profile.name Name of the identity profile this identity belongs to. keyword
sailpoint_identity_sc.identity.inactive Indicates whether this identity is inactive. boolean
sailpoint_identity_sc.identity.is_manager Indicates whether this identity is a manager. boolean
sailpoint_identity_sc.identity.locked Indicates whether this identity account is locked. boolean
sailpoint_identity_sc.identity.manager.display_name Display name of the identity's manager. keyword
sailpoint_identity_sc.identity.manager.id ID of the identity's manager. keyword
sailpoint_identity_sc.identity.manager.name Username of the identity's manager. keyword
sailpoint_identity_sc.identity.org Organization (tenant) identifier for this identity. keyword
sailpoint_identity_sc.identity.owns.access_profiles.id ID of an owned access profile. keyword
sailpoint_identity_sc.identity.owns.access_profiles.name Name of an owned access profile. keyword
sailpoint_identity_sc.identity.owns.apps.id ID of an owned application. keyword
sailpoint_identity_sc.identity.owns.apps.name Name of an owned application. keyword
sailpoint_identity_sc.identity.owns.entitlements.id ID of an owned entitlement. keyword
sailpoint_identity_sc.identity.owns.entitlements.name Name of an owned entitlement. keyword
sailpoint_identity_sc.identity.owns.governance_groups.id ID of an owned governance group. keyword
sailpoint_identity_sc.identity.owns.governance_groups.name Name of an owned governance group. keyword
sailpoint_identity_sc.identity.owns.roles.id ID of an owned role. keyword
sailpoint_identity_sc.identity.owns.roles.name Name of an owned role. keyword
sailpoint_identity_sc.identity.owns.sources.id ID of an administered source. keyword
sailpoint_identity_sc.identity.owns.sources.name Name of an administered source. keyword
sailpoint_identity_sc.identity.owns_count Number of access items owned by this identity. long
sailpoint_identity_sc.identity.pod Pod (deployment region) where this identity is hosted. keyword
sailpoint_identity_sc.identity.processing_state Processing state of the identity (null when not in a special state). keyword
sailpoint_identity_sc.identity.protected Indicates whether this identity is protected from modification. boolean
sailpoint_identity_sc.identity.role_count Number of roles assigned to this identity. long
sailpoint_identity_sc.identity.source.id ID of the authoritative source for this identity. keyword
sailpoint_identity_sc.identity.source.name Name of the authoritative source for this identity. keyword
sailpoint_identity_sc.identity.status Identity lifecycle status (for example, ACTIVE). keyword
sailpoint_identity_sc.identity.supervises_error Error from the supervises enrichment call. Set when the direct reports lookup returned a non-200 response; absent when enrichment succeeded or was not attempted. keyword
sailpoint_identity_sc.identity.tags Tags applied to this identity. keyword
sailpoint_identity_sc.identity.visible_segments List of segment names visible to this identity. keyword
tags List of keywords used to tag each event. keyword
user.domain Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. keyword
user.email User email address. keyword
user.entity.id A unique identifier for the entity. When multiple identifiers exist, this should be the most stable and commonly used identifier that: 1) persists across the entity's lifecycle, 2) ensures uniqueness within its scope, 3) is commonly used for queries and correlation, and 4) is readily available in most observations (logs/events). For entities with dedicated field sets (for example, host, user), this value should match the corresponding *.id field. Alternative identifiers (for example, ARNs values in AWS, URLs) can be preserved in the raw field. keyword
user.entity.name The name of the entity. The keyword field enables exact matches for filtering and aggregations, while the text field enables full-text search. For entities with dedicated field sets (for example, host), this field should mirrors the corresponding *.name value. keyword
user.entity.name.text Multi-field of user.entity.name. match_only_text
user.entity.relationships.administers.service.id Referenced service ids. keyword
user.entity.relationships.administers.service.name Referenced service names. keyword
user.entity.relationships.owns.service.id Referenced service ids. keyword
user.entity.relationships.owns.service.name Referenced service names. keyword
user.entity.relationships.supervises.user.email Referenced user email addresses. keyword
user.entity.relationships.supervises.user.id Referenced user ids. keyword
user.entity.relationships.supervises.user.name Referenced user short names or logins. keyword
user.entity.type A standardized high-level classification of the entity. This provides a normalized way to group similar entities across different providers or systems. Example values: bucket, database, container, function, queue, host, user, application, session, cloud, orchestrator, etc. If an entity is nested under a top-level namespace like host or cloud, or similar, its type array should include the matching value — for example, host or cloud. keyword
user.full_name User's full name, if available. keyword
user.full_name.text Multi-field of user.full_name. match_only_text
user.group.name Name of the group. keyword
user.id Unique identifier of the user. keyword
user.name Short name or login of the user. keyword
user.name.text Multi-field of user.name. match_only_text
user.roles Array of user roles at the time of the event. keyword

Machine identity documents can be found by setting the following filter: event.dataset : "sailpoint_identity_sc.machine_identities"

Machine identity documents carry ECS entity fields (service.entity.*) that enable entity analytics for non-human identities such as service accounts, application accounts, bots, and AI agents.

Example 
{
    "@timestamp": "2025-01-10T08:45:00.000Z",
    "agent": {
        "ephemeral_id": "652be181-cca8-45d2-9801-507f8e7398ce",
        "id": "1ddb6c40-b55a-42ce-9a31-1fd179a65c72",
        "name": "elastic-agent-23115",
        "type": "filebeat",
        "version": "9.5.3"
    },
    "data_stream": {
        "dataset": "sailpoint_identity_sc.machine_identities",
        "namespace": "22515",
        "type": "logs"
    },
    "ecs": {
        "version": "9.4.0"
    },
    "elastic_agent": {
        "id": "1ddb6c40-b55a-42ce-9a31-1fd179a65c72",
        "snapshot": false,
        "version": "9.5.3"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "dataset": "sailpoint_identity_sc.machine_identities",
        "ingested": "2026-09-14T11:00:06Z",
        "kind": "asset",
        "module": "sailpoint_identity_sc",
        "original": "{\"attributes\":{\"env\":\"production\",\"team\":\"Platform\"},\"created\":\"2024-01-15T10:30:00Z\",\"datasetId\":\"ds-id-aabbccdd-1111-2222-3333-000000000001\",\"description\":\"Example service account for integration tests.\",\"id\":\"mi-id-aabbccdd-1111-2222-3333-000000000001\",\"manuallyCreated\":false,\"manuallyEdited\":false,\"modified\":\"2025-01-10T08:45:00Z\",\"name\":\"svc-example-service\",\"nativeIdentity\":\"svc-example:prod:00001\",\"owners\":{\"primaryIdentity\":{\"id\":\"00000000000000000000000000000001\",\"name\":\"alice.example\",\"type\":\"IDENTITY\"},\"secondaryIdentities\":[]},\"source\":{\"id\":\"src-id-aabbccdd-1111-2222-3333-000000000001\",\"name\":\"Example Directory\",\"type\":\"SOURCE\"},\"sourceId\":\"src-id-aabbccdd-1111-2222-3333-000000000001\",\"subtype\":\"Application\",\"userEntitlements\":[],\"uuid\":\"uuid-aabbccdd-1111-2222-3333-000000000001\"}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "user": [
            "alice.example"
        ]
    },
    "sailpoint_identity_sc": {
        "machine_identity": {
            "attributes": {
                "env": "production",
                "team": "Platform"
            },
            "created": "2024-01-15T10:30:00.000Z",
            "dataset_id": "ds-id-aabbccdd-1111-2222-3333-000000000001",
            "description": "Example service account for integration tests.",
            "manually_created": false,
            "manually_edited": false,
            "modified": "2025-01-10T08:45:00.000Z",
            "native_identity": "svc-example:prod:00001",
            "owners": {
                "primary": {
                    "id": "00000000000000000000000000000001",
                    "name": "alice.example"
                }
            },
            "source": {
                "id": "src-id-aabbccdd-1111-2222-3333-000000000001",
                "name": "Example Directory"
            },
            "source_id": "src-id-aabbccdd-1111-2222-3333-000000000001",
            "uuid": "uuid-aabbccdd-1111-2222-3333-000000000001"
        }
    },
    "service": {
        "entity": {
            "id": "mi-id-aabbccdd-1111-2222-3333-000000000001",
            "name": "svc-example-service",
            "type": [
                "service"
            ]
        },
        "id": "mi-id-aabbccdd-1111-2222-3333-000000000001",
        "name": "svc-example-service",
        "type": "Application"
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "sailpoint_identity_sc.machine_identities"
    ]
}

ECS Field Reference

Refer to the following document for detailed information on ECS fields.

The following non-ECS fields are used in identities documents:

Exported fields
Field Description Type
@timestamp Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. date
data_stream.dataset The field can contain anything that makes sense to signify the source of the data. Examples include nginx.access, prometheus, endpoint etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. event.dataset should have the same value as data_stream.dataset. Beyond the Elasticsearch data stream naming criteria noted above, the dataset value has additional restrictions: * Must not contain - * No longer than 100 characters constant_keyword
data_stream.namespace A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with default. If no value is used, it falls back to default. Beyond the Elasticsearch index naming criteria noted above, namespace value has the additional restrictions: * Must not contain - * No longer than 100 characters constant_keyword
data_stream.type An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. constant_keyword
ecs.version ECS version this event conforms to. ecs.version is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. keyword
event.category This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. event.category represents the "big buckets" of ECS categories. For example, filtering on event.category:process yields all events relating to process activity. This field is closely related to event.type, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. keyword
event.dataset Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. constant_keyword
event.kind This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. event.kind gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. keyword
event.module Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), event.module should contain the name of this module. constant_keyword
event.original Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from _source. If users wish to override this and index this field, please see Field data types in the Elasticsearch Reference. keyword
event.type This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. event.type represents a categorization "sub-bucket" that, when used along with the event.category field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. keyword
input.type Input type. keyword
related.user All the user names or other user identifiers seen on the event. keyword
sailpoint_identity_sc.machine_identity.attributes Dynamic attribute map from the machine identity record (tenant-specific keys). flattened
sailpoint_identity_sc.machine_identity.created Timestamp when the machine identity was created. date
sailpoint_identity_sc.machine_identity.dataset_id Dataset ID associated with this machine identity record. keyword
sailpoint_identity_sc.machine_identity.description Free-text description of the machine identity. text
sailpoint_identity_sc.machine_identity.manually_created Indicates whether the machine identity was manually created. boolean
sailpoint_identity_sc.machine_identity.manually_edited Indicates whether the machine identity was manually edited. boolean
sailpoint_identity_sc.machine_identity.modified Timestamp when the machine identity was last modified. date
sailpoint_identity_sc.machine_identity.native_identity Account name assigned to the machine identity on the source system. keyword
sailpoint_identity_sc.machine_identity.owners.primary.id ID of the primary owner identity. keyword
sailpoint_identity_sc.machine_identity.owners.primary.name Account name of the primary owner identity. keyword
sailpoint_identity_sc.machine_identity.owners.secondary.id ID of the secondary owner identity. keyword
sailpoint_identity_sc.machine_identity.owners.secondary.name Account name of the secondary owner identity. keyword
sailpoint_identity_sc.machine_identity.owners.secondary.type Type of the secondary owner reference. keyword
sailpoint_identity_sc.machine_identity.source.id ID of the source system associated with this machine identity. keyword
sailpoint_identity_sc.machine_identity.source.name Name of the source system associated with this machine identity. keyword
sailpoint_identity_sc.machine_identity.source_id Plain source ID string from the machine identity record. keyword
sailpoint_identity_sc.machine_identity.user_entitlements.display_name Display name of the entitlement. keyword
sailpoint_identity_sc.machine_identity.user_entitlements.entitlement_id ID of the entitlement held by this machine identity. keyword
sailpoint_identity_sc.machine_identity.user_entitlements.source.id ID of the entitlement source. keyword
sailpoint_identity_sc.machine_identity.user_entitlements.source.name Name of the entitlement source. keyword
sailpoint_identity_sc.machine_identity.user_entitlements.source.type Type of the entitlement source. keyword
sailpoint_identity_sc.machine_identity.user_entitlements.source_id ID of the source system providing this entitlement. keyword
sailpoint_identity_sc.machine_identity.uuid UUID of the machine identity on the source system. keyword
service.entity.id A unique identifier for the entity. When multiple identifiers exist, this should be the most stable and commonly used identifier that: 1) persists across the entity's lifecycle, 2) ensures uniqueness within its scope, 3) is commonly used for queries and correlation, and 4) is readily available in most observations (logs/events). For entities with dedicated field sets (for example, host, user), this value should match the corresponding *.id field. Alternative identifiers (for example, ARNs values in AWS, URLs) can be preserved in the raw field. keyword
service.entity.name The name of the entity. The keyword field enables exact matches for filtering and aggregations, while the text field enables full-text search. For entities with dedicated field sets (for example, host), this field should mirrors the corresponding *.name value. keyword
service.entity.name.text Multi-field of service.entity.name. match_only_text
service.entity.type A standardized high-level classification of the entity. This provides a normalized way to group similar entities across different providers or systems. Example values: bucket, database, container, function, queue, host, user, application, session, cloud, orchestrator, etc. If an entity is nested under a top-level namespace like host or cloud, or similar, its type array should include the matching value — for example, host or cloud. keyword
service.id Unique identifier of the running service. If the service is comprised of many nodes, the service.id should be the same for all nodes. This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event. Note that if you need to see the events from one specific host of the service, you should filter on that host.name or host.id instead. keyword
service.name Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the service.name could contain the cluster name. For Beats the service.name is by default a copy of the service.type field if no name is specified. keyword
service.type The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, service.type would be elasticsearch. keyword
tags List of keywords used to tag each event. keyword

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.

Events Dashboard
Identity Dashboard
Machine Identity Dashboard
Changelog
Version Details Minimum Kibana version
2.0.0 Enhancement (View pull request)
Add ECS entity field mappings to the events data stream.

Enhancement (View pull request)
Add identities data stream for human identity records via the Search API.

Enhancement (View pull request)
Add machine_identities data stream for machine identity records via the Machine Identities API.

Enhancement (View pull request)
Add tags to ingest pipeline processors.

Bug fix (View pull request)
Remove two redundant no-op set processors for event.dataset and event.module in the events data stream.

Enhancement (View pull request)
Update default API version to v2026.

Bug fix (View pull request)
Disable request tracing by default.		 9.0.5
8.19.2
1.3.1 Enhancement (View pull request)
Set agentless deployment mode release field to ga.		 9.0.5
8.19.2
1.3.0 Enhancement (View pull request)
Enable Agentless deployment.		 9.0.5
8.19.2
1.2.0 Enhancement (View pull request)
Pass events from the agent as serialized JSON strings.

Enhancement (View pull request)
Improve ingest pipeline error handling.

Enhancement (View pull request)
Improve agent request error handling.		 9.0.0
8.16.1
1.1.0 Enhancement (View pull request)
Add option to select the API version to use.

Bug fix (View pull request)
Fix POST request format for events data stream.		 9.0.0
8.16.1
1.0.0 Enhancement (View pull request)
Release package as GA.		 9.0.0
8.16.1
0.3.1 Bug fix (View pull request)
Fix default request trace enabled behavior.		 9.0.0
8.16.1
0.3.0 Enhancement (View pull request)
Enable request trace log removal.		 9.0.0
8.16.1
0.2.1 Bug fix (View pull request)
Added description to ssl nodes in package level manifest.yml file to including links to documentation.		 9.0.0
8.16.1
0.2.0 Enhancement (View pull request)
Update Kibana constraint to support 9.0.0.		 9.0.0
8.16.1
0.1.0 Enhancement (View pull request)
Initial release.		 8.16.1